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I. Introduction 

Good morning Chairman Levin, Ranking Member Coburn, and members of the 
Subcommittee. My name is Paul Thurston, and I currently serve as the Chief Executive, Retail 
Banking and Wealth Management for HSBC Group, based in Hong Kong. 

I have worked in the banking industry for my entire career. I joined Midland Bank in 
1975, and stayed when it was acquired by HSBC in 1992. Since then, I have served in various 
roles at HSBC around the world, including as CEO of HSBC Mexico ("HBMX") for fourteen 
months beginning in February 2007. 

I understand that we are here today in part to discuss HSBC's experience in Mexico and 
its impact on the U.S. and global financial systems. These are topics worthy of discussion, and 
which have had many learnings for our Group, and I am pleased to be here at the Committee's 
request. I want to address in my statement the challenges I faced when I arrived in Mexico, the 
steps my colleagues and I took to address the problems, and the lessons I believe we at HSBC 
have learned from our experience in Mexico. 

II. HBMX 

Emerging markets like Mexico are growing increasingly important in their contribution 
to the global economy and world trade, and international financial companies can play an 
important role to help their governments develop these markets and their people to join the 
formal banking system. With large populations existing outside the formal economy and 
banking system, however, they also present real challenges. 
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I arrived in Mexico in early 2007 after having served as a general manager with 
responsibility for building the Group's personal financial service businesses across the Asia 
Pacific region. When I arrived, I reported to my predecessor, who, having completed the 
acquisition of the former Banco Bital and managed this business for 4 years, had also led the 
subsequent acquisition of the Banistmo Group of banks across Central America and been 
promoted to head up the Latin American region. 

To enable me to assess the business, I had meetings with members of the management 
team, the internal auditors, the external auditors, and the Board of HBMX. I also met with the 
regulators, each of whom were complimentary about the progress made by the bank since 
acquisition. It became clear to me, however, that there had been rapid growth of the business 
since the acquisition, and that there were still significant issues that needed to be addressed. 
These included rapidly growing credit and fraud losses in the consumer and small business 
lending businesses, technology problems, and weaknesses in management information. There 
was also a significant known compliance issue relating to the quality of customer Know-Your- 
Customer ("KYC") and customer files, all of which were decentralized across the network of 
more than 1300 branches, but where recent regulations required 1.8 million customer KYC 
records to be remediated to meet new local standards. 

Having thought that I would be continuing to build the business, my immediate priorities 
became to address these issues. Additionally, most of the management team of the bank in 
Mexico had also been promoted to regional positions to manage the now larger region, and I 
therefore had to fill key positions within the Mexican business to ensure that we retained a focus 
on managing this business. 
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As I began to get the team in place, additional issues arose, and it became clearer that 
HBMX lacked much of the sophisticated compliance, operational, and risk management 
capabilities with which I was familiar from my work in other parts of the Group. There was no 
credit fraud expertise, credit risk analytics were undeveloped, and provisioning models and 
scorecards were not robust. It also became apparent that decision-making processes concerning 
AML were not satisfactory. 

Over time, it also became clear that this was not only a question of process and 
technology, but that the underlying business model needed to be examined. Branch managers 
operated as local franchise owners, with considerable autonomy and a focus on business 
development, reinforced by an incentive compensation scheme which rewarded new accounts 
and growth, not quality controls. 

I should add that the external environment in Mexico was as challenging as any I had 
ever experienced. Bank employees faced very real risks of being targeted for bribery, extortion, 
and kidnapping - in fact, multiple kidnappings occurred throughout my tenure - and high levels 
of security were required for Bank staff working in Mexico. Unlike the United States, Mexico 
was a data-poor environment, making it difficult to verify the identity of customers. 

Despite these substantial challenges, I felt that with determined efforts, the Bank could 
make a positive contribution in Mexico. During my short tenure at HBMX, I worked hard to 
make progress towards this goal, and I drove many changes to both the business model and 
compliance systems. 

I pulled back on business expansion plans and focused on enhancing controls. I was 
particularly concerned with HBMX's significant operational and credit losses, especially in small 
business loans and credit cards, where fraud was rising rapidly. I brought in people with 
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expertise in managing emerging markets credit risk in Asia and fraud management from the 
Group to review our practices in those areas, tightened credit approvals, and brought in a new 
Head of Consumer Credit Risk. I also brought in a new CFO to develop improved management 
information capabilities. 

To address the compliance issues, I brought in a new COO who was well-regarded and 
experienced with Group standards. With his help, we made significant changes in AML and 
KYC processes, including addressing AML Committee weaknesses, ensuring that action items 
were properly followed up, and creating an escalation process when business and compliance 
disagreed. We launched new staff training programs on AML and KYC standards, and 
introduced a zero tolerance policy regarding the site visit requirement. 

Recognizing the challenges of trying to affect proper remediation of files and upgrading 
account opening processes across a widespread branch network managed by local managers 
incentivized and historically managed for growth, we set up a program to centralize control of 
account opening documentation and KYC records. We also reworked the employee incentive 
scheme to reduce reward for volume growth and increase the focus on credit quality, customer 
service, and proper management of risk. We also removed senior management from the 
incentive scheme entirely. 

As you might expect, these changes were painful to the organization. For example, to 
rework the incentive scheme, at one point I had to stop payment of incentives altogether. This 
resulted in employees picketing the office. However, my team and I were determined to 
continue pushing forward with the improvements. 

All of the issues that I identified, and the actions taken to address them, were reported up 
to the regional head of Latin America and to Group management. I requested Group Compliance 
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support to help review issues and people, and address cross-border issues. I also requested 
Group Audit to undertake audits of key processes, including the Money Laundering controls, to 
have an independent check of progress and help to surface other issues that had not previously 
been identified. The local Board, and the regional audit committee, which was chaired by the 
Group's Chief Risk Officer and head of Audit, were kept informed throughout. Reports were 
made to the Group Risk Management Meeting which included the heads of each of the regions. 

In December 2007, less than a year after I had arrived, I was asked by the Group Chief 
Executive to prepare to move to the U.K. to take responsibility for our retail business there in the 
face of issues that led up to global financial crisis and to recruit a successor in the local market. I 
did this and left Mexico in April 2008. 

I believe that we made progress at HBMX during my short tenure, but clearly there was 
still much work to be done upon my departure. I understand that further problems surfaced 
subsequently, which had to be addressed by my successor and Group management, and that 
progress was therefore not as smooth as we would have wanted. I understand however that there 
was a significant improvement in account opening standards, documentation, and reporting in the 
following years as the centralized system came into effect, which gave HBMX a better platform 
to establish enhanced control on account opening and remediate historic accounts. Decisions 
were made to put strict limits on the U.S. dollar business we do in Mexico, we closed branches in 
areas where we believe there is a high risk of money laundering, and we are now in the process 
of closing all the HBMX Cayman accounts. The Group will continue to scrutinize our business 
there to determine how we can further mitigate compliance risk. 
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Many of the specific challenges I faced during my tenure, and the actions that I took, will 
likely be outlined more fully in your report. I will answer your questions to the best of my 
ability based on my time on the ground in Mexico, as I did with your staff several weeks ago. 
III. Lessons Learned 

We have learned much from our experience in Mexico, and I would like to discuss briefly 
some of what I consider to be the key lessons. 

First , when a problem arises, it is imperative to do the right thing and to do it quickly. 
During my tenure in Mexico, I tried to follow this rule. For example, in response to compliance 
failures, I fired individuals involved in falsifying KYC records and announced a zero tolerance 
policy for similar conduct, and we closed customer accounts, despite the risk of adverse reaction. 
The Group is taking firm action today to close down businesses where the risks cannot be 
effectively managed, regardless of the impact on short term profitability, and have invested in 
increased compliance resourcing. 

Second , business expansion cannot be allowed to run ahead of putting in place 
appropriate controls and infrastructure. Without adequate controls, financial institutions face 
severe business and operational risks that are simply unacceptable. In retrospect, it is clear that 
in Mexico, the Group was overly optimistic about our ability to bring up to standards quickly an 
acquired entity that had little to no compliance and operational infrastructure when we acquired 
it. The Group today is working hard to reduce its complexity and risk profile, and to empower 
Global Functions, including Risk and Compliance, to have direct oversight of the key controls 
across our business. 

Third , operational and compliance risk cannot be addressed by systems and process 
alone. In Mexico, we made little progress by simply installing Group systems and creating 
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control functions until we addressed the culture of the bank and the underlying business model. 
Cultural change takes time, but getting the tone at the top right, and changing performance 
management systems and rewards, are critical drivers to achieving higher standards. 

Fourth, when challenges arise, we must share information broadly across the Bank. 
During my tenure in Mexico, information at HSBC flowed vertically but not horizontally. The 
Subcommittee is right to note that, as a result, a number of risks and challenges we faced in 
Mexico were not fully appreciated by our counterparts in other parts of the Group. We are 
changing this through formal reporting structures to ensure that we maximize the sharing of 
information for risk management purposes amongst Group companies and amongst Global 
businesses and functions. 

Finally , we cannot be afraid to acknowledge and learn from our mistakes. We have 
directly acknowledged our shortcomings in Mexico and in the United States, and our Group 
CEO has set a clear policy that requires all parts of the Group to adopt and enforce a single 
global standard that is determined by the highest standard that must be applied anywhere and 
also requires us to maximize information sharing across the Group. This will help make us a 
better bank that effectively manages risk consistently on a global basis. 
IV. Conclusion 

Criminals operate globally and if we are to combat them and stop them from accessing 
and abusing the financial system, we must look at issues from a global perspective. Institutions 
which operate internationally, like HSBC, will be targeted by these criminals, and our experience 
in Mexico vividly demonstrates that you are no stronger than your weakest link. We have to be 
sure that we have the best and strongest defense in place, in every business, in every market in 



-7 - 



which we operate, regardless of the local challenges. It is for this reason that I appreciate the 
opportunity to speak with the Subcommittee today. 

It is clear to us all that our anti-money laundering controls should have been stronger and 
more effective, and that we fell well below the standards that we should have achieved. We have 
co-operated fully with the PSI and other authorities to ensure that we learn from the mistakes that 
were made in the past. 

We are determined that drug dealers, terrorists, and all forms of criminals will not access 
the financial system through HSBC. The Group management team is committed to ensuring that 
we meet the highest standards in every aspect of our business in the future. 
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